%3CLINGO-SUB%20id%3D%22lingo-sub-1671011%22%20slang%3D%22en-US%22%3ERe%3A%20Say%20hello%20to%20the%20new%20Microsoft%20Threat%20Protection%20APIs!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1671011%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20Splunk%20form%20give%20%22no%20permission%22%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1671132%22%20slang%3D%22en-US%22%3ERe%3A%20Say%20hello%20to%20the%20new%20Microsoft%20Threat%20Protection%20APIs!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1671132%22%20slang%3D%22en-US%22%3E%3CP%3EVery%20good%20your%20article.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20liked%20what%20I%20read.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20some%20doubts%20and%20would%20like%20to%20receive%20opinions%20that%20can%20contribute.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThese%20are%20more%20questions%20related%20to%20Sentinel%20and%20MTP.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20the%20solutions%20in%20my%20environment%20and%20I'm%20in%20doubt%20about%20how%20to%20centralize%20everything.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20have%20Azure%20Sentinel%20receiving%20the%20Defender%20Atp%2C%20MCASB%2C%20Azure%20ATp%2C%20Office%20365%20ATp%20logs%2C%20among%20others.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20also%20have%20MCAS%20integrated%20with%20Azure%20ATP.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThe%20question%20is.%20Where%20should%20all%20technologies%20be%20centralized%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThat%20is%2C%20if%20I%20use%20Microsoft%20365%20Security%20Center%20to%20centralize%20Defender%20ATP%2C%20Azure%20ATP%2C%20MCAS%20and%20Office%20ATP%2C%20does%20it%20still%20make%20sense%20to%20receive%20these%20logs%20in%20Sentinel%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWould%20it%20be%20possible%20to%20integrate%20alerts%20generated%20in%20Sentinel%20with%20Microsoft%20365%20Security%20Center%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20I%20receive%20the%20solution%20logs%20on%20Sentinel%2C%20what%20would%20be%20the%20meaning%20of%20Microsoft%20365%20Security%20Center%3F%20Can%20I%20work%20with%20both%2C%20centralizing%20the%20solutions%20in%20both%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20know%20that%20there%20may%20not%20be%20a%20final%20answer%2C%20but%20I%20would%20be%20happy%20to%20get%20your%20position.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThank%20you.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1671798%22%20slang%3D%22en-US%22%3ERe%3A%20Say%20hello%20to%20the%20new%20Microsoft%20Threat%20Protection%20APIs!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1671798%22%20slang%3D%22en-US%22%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%3CSPAN%20class%3D%22UserName%20lia-user-name%20lia-user-rank-Occasional-Contributor%20lia-component-message-view-widget-author-username%22%3E%3CA%20id%3D%22link_12%22%20class%3D%22lia-link-navigation%20lia-page-link%20lia-user-name-link%22%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F559958%22%20target%3D%22_self%22%3E%3CSPAN%20class%3D%22%22%3E%3C%2FSPAN%3E%3C%2FA%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F559958%22%20target%3D%22_blank%22%3E%40mrboxx%3C%2FA%3E%26nbsp%3B%2C%3CSTRONG%3E%20issue%20is%20fixed%20please%20try%20again.%3C%2FSTRONG%3E%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1673176%22%20slang%3D%22en-US%22%3ERe%3A%20Say%20hello%20to%20the%20new%20Microsoft%20Threat%20Protection%20APIs!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1673176%22%20slang%3D%22en-US%22%3E%3CP%3EAlso%20updated%20my%20Postman%20collection%20this%20AM!%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2Frichlilly2004%2FMicrosoft-Threat-Protection%2Ftree%2Fmaster%2FPostman%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3EMicrosoft-Threat-Protection%2FPostman%20at%20master%20%C2%B7%20richlilly2004%2FMicrosoft-Threat-Protection%20(github.com)%3C%2FA%3E%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22richlilly_0-1600261426731.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F218733iA6AAC6666255C7DB%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20title%3D%22richlilly_0-1600261426731.png%22%20alt%3D%22richlilly_0-1600261426731.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1694362%22%20slang%3D%22en-US%22%3ERe%3A%20Say%20hello%20to%20the%20new%20Microsoft%20Threat%20Protection%20APIs!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1694362%22%20slang%3D%22en-US%22%3E%3CUL%3E%3CLI%3E%3CSPAN%3EFor%20m%3C%2FSPAN%3E%3CSPAN%3Eore%20about%20incidents%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Ewatch%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-threat-protection%2Fsee-how-consolidated-incidents-improve-soc-efficiency-through%2Fba-p%2F1557341%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3E%3CSPAN%3Ethis%20short%20video%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Eor%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Eread%20more%20about%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Ethe%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-threat-protection%2Fsee-how-consolidated-incidents-improve-soc-efficiency-through%2Fba-p%2F1557341%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3E%3CSPAN%3Elogic%20that%20drives%20it%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%3C%2FUL%3E%3CP%3E%3CSPAN%3EBoth%20links%20are%20the%20same.%20%3CEM%3EVideo%3C%2FEM%3E%20link%20opens%20the%20page%20with%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%3EP.S.%3A%20Thanks%20for%20the%20article!%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1698227%22%20slang%3D%22en-US%22%3ERe%3A%20Say%20hello%20to%20the%20new%20Microsoft%20Threat%20Protection%20APIs!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1698227%22%20slang%3D%22en-US%22%3E%3CP%3ERegarding%20%22%3CSPAN%3Ewe%20are%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Eworking%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3Bto%20also%20expose%20an%20event%20streaming%20interface%20allowing%20customers%20to%20flow%20event%20data%20to%20an%20external%20storage%2C%22%20any%20ETA%20on%20this%3F%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1698239%22%20slang%3D%22en-US%22%3ERe%3A%20Say%20hello%20to%20the%20new%20Microsoft%20Threat%20Protection%20APIs!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1698239%22%20slang%3D%22en-US%22%3E%3CDIV%20class%3D%22lia-message-author-avatar%20lia-component-author-avatar%20lia-component-message-view-widget-author-avatar%20UserAvatarWrapper%22%3E%0A%3CDIV%20class%3D%22UserAvatarWrapper%22%3E%0A%3CDIV%20class%3D%22UserAvatar%20lia-user-avatar%20lia-component-common-widget-user-avatar%20New%20Contributor%22%3E%0A%3CDIV%20id%3D%22tinyMceEditorEfrat%20Kliger_0%22%20class%3D%22mceNonEditable%20lia-copypaste-placeholder%22%3E%26nbsp%3B%3C%2FDIV%3E%0A%3C%2FDIV%3E%0A%3C%2FDIV%3E%0A%3C%2FDIV%3E%0A%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%3CSPAN%20class%3D%22UserName%20lia-user-name%20lia-user-rank-New-Contributor%20lia-component-message-view-widget-author-username%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F733311%22%20target%3D%22_blank%22%3E%40luizao_lf%3C%2FA%3E%26nbsp%3B%22MTP%20sentinel%26nbsp%3B%3CSPAN%20class%3D%22TextRun%20SCXW236535880%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW236535880%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3Econnector%20is%20also%20on%20the%20way%2C%20coming%20soon%20later%20this%20calendar%20year%22%2F%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22EOP%20SCXW236535880%20BCX0%22%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3EWe%20are%20planning%20to%20take%20care%20of%20all%20of%20Microsoft%20Threat%20Protection%20products%20for%20you%20with%20a%20single%20Sentinel%20connector.%26nbsp%3B%3CBR%20%2F%3EPlease%20look%20for%20our%20upcoming%20announcements..%20I%20can't%20share%20more%20at%20the%20moment%20we%20are%20looking%20to%20surprise%20you%20%3A)%3C%2Fimg%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FDIV%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1698243%22%20slang%3D%22en-US%22%3ERe%3A%20Say%20hello%20to%20the%20new%20Microsoft%20Threat%20Protection%20APIs!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1698243%22%20slang%3D%22en-US%22%3E%3CDIV%20class%3D%22lia-message-author-with-avatar%22%3E%3CSPAN%20class%3D%22UserName%20lia-user-name%20lia-user-rank-Occasional-Visitor%20lia-component-message-view-widget-author-username%22%3E%3CSPAN%20class%3D%22UserName%20lia-user-name%20lia-user-rank-Occasional-Visitor%20lia-component-message-view-widget-author-username%22%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F692070%22%20target%3D%22_blank%22%3E%40heaga%3C%2FA%3E%2C%26nbsp%3Bwe%20will%20share%20more%20soon%2C%20send%20me%20your%20details%20in%20case%20you%20would%20like%20to%20join%20the%20very%20early%20preview.%20We%20will%20start%20with%20email%20%2B%20endpoint%20raw%20data.%26nbsp%3B%20%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22UserName%20lia-user-name%20lia-user-rank-Occasional-Visitor%20lia-component-message-view-widget-author-username%22%3E%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1669234%22%20slang%3D%22en-US%22%3ESay%20hello%20to%20the%20new%20Microsoft%20Threat%20Protection%20APIs!%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1669234%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EA%20typical%20enterprise%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eenvironment%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Boften%20requires%20customers%20to%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eaugment%20security%20solutions%20by%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ebuild%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eing%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Btheir%20own%20custom%20automation%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Elogic%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bto%20automate%20procedures%2C%20integrate%20data%2C%20and%20orchestrate%20actions%20to%20enable%20security%20teams%20to%20effectively%20operate%20and%20respond%20to%20threats.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3E%E2%80%AF%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EToday%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bwe%20are%20announcing%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Epublic%20preview%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ef%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eor%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Et%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ehree%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bexciting%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eenhancements%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%3A%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%2214%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%221%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%20Threat%20Protection%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EIncident%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EHunting%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EAPIs%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%2214%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%222%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EN%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eew%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%20Threat%20Protection%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3ESIEM%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Econnectors%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Efor%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3ESplunk%20Enterprise%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicro%20Focus%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EArcSight%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%2214%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%222%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%20Threat%20Protection%20alerts%20will%20be%20available%20soon%20via%20the%20Microsoft%20Graph%20Security%20API%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20aria-level%3D%222%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EWith%20these%20t%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ehree%20a%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Edditions%2C%20Microsoft%20Threat%20Protection%20is%20now%20an%20integration-ready%20platform!%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3CBR%20%2F%3ELet%E2%80%99s%20have%20a%20closer%20look%20at%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ethe%20new%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ecapabilities%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%3A%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%20Threat%20Protection%20API%20model%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CLI-WRAPPER%3E%3C%2FLI-WRAPPER%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%20Defender%20ATP%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eoffers%20a%20layered%20API%20model%20exposing%20data%20and%20capabilities%20in%20a%20structured%2C%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eclear%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%20easy%20to%20use%20model%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E.%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EE%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Exposed%20through%20a%20standard%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EAzure%20Active%20Directory%20(%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EAAD%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E)%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bbased%20authentication%20and%20authorization%20model%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eand%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eallowing%20access%20in%20context%20of%20users%20or%20SaaS%20applications.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EThe%20lop-level%20Microsoft%20Threat%20Protection%20APIs%20will%20enable%20you%20to%20automate%20workflows%20based%20on%20the%20shared%20incident%20and%20advanced%20hunting%20tables%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%3A%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%3CBR%20%2F%3EThe%20I%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3Encidents%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EAPI%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%E2%80%AF-%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EThis%20API%20exposes%20Microsoft%20Threat%20Protection%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-threat-protection%2Fsee-how-consolidated-incidents-improve-soc-efficiency-through%2Fba-p%2F1557341%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3E%3CSPAN%20data-contrast%3D%22none%22%3Eincidents%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B-%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ea%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bmore%20efficient%2C%20more%20comprehensive%20and%20more%20descriptive%20evolution%20of%20alerts.%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EIncidents%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eh%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eelp%20security%20professionals%20focus%20on%20what's%20critical%20by%20ensuring%20that%20the%20full%20attack%20scope%20and%20impacted%20assets%20are%20grouped%20together%20and%20surfaced%20in%20a%20timely%20manner%20under%20the%20incident%20API%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559685%26quot%3B%3A570%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%20data-leveltext%3D%22o%22%20data-font%3D%22Courier%20New%22%20data-listid%3D%221%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%221%22%20data-aria-level%3D%222%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EFor%20m%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eore%20about%20incidents%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ewatch%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-threat-protection%2Fsee-how-consolidated-incidents-improve-soc-efficiency-through%2Fba-p%2F1557341%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3E%3CSPAN%20data-contrast%3D%22none%22%3Ethis%20short%20video%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eor%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eread%20more%20about%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ethe%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fmicrosoft-threat-protection%2Fsee-how-consolidated-incidents-improve-soc-efficiency-through%2Fba-p%2F1557341%22%20target%3D%22_blank%22%20rel%3D%22noopener%22%3E%3CSPAN%20data-contrast%3D%22none%22%3Elogic%20that%20drives%20it%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20class%3D%22lia-indent-padding-left-30px%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EYou%20can%20pull%20all%20the%20alerts%20related%20to%20the%20incident%20and%20other%20information%20about%20them%20such%20as%20severity%2C%20entities%20that%20were%20involved%20in%20the%20alert%2C%20the%20source%20of%20the%20alerts%20(Azure%20ATP%2C%20Microsoft%20Defender%20ATP%20%2C%20Office%20365%20ATP)%20and%20the%20reason%20they%20were%20linked%20together.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3ETo%20learn%20more%20about%20the%20schema%20see%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fapi-list-incidents%3Fview%3Do365-worldwide%26amp%3Bbranch%3Dmtp-apis%2522%2520%255C%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%3EIncidents%20API%26nbsp%3B%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%3CSPAN%20class%3D%22TextRun%20SCXW186318185%20BCX0%22%20data-contrast%3D%22auto%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW186318185%20BCX0%22%3Eand%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CA%20class%3D%22Hyperlink%20SCXW186318185%20BCX0%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fapi-update-incidents%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20class%3D%22TextRun%20Underlined%20SCXW186318185%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW186318185%20BCX0%22%20data-ccp-charstyle%3D%22Hyperlink%22%3EUpdate%20Incident%20API.%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FA%3E%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%3CBR%20%2F%3E%3CBR%20%2F%3ECross-product%20threat%20hunting%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%E2%80%AF%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EAPI%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E-%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EThis%20API%20provides%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Equery-based%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eaccess%20to%20Microsoft%20Threat%20Protection%20raw%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Edata%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Estore%2C%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eaggregated%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eacross%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ethe%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Esuite%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bprotection%20products.%3C%2FSPAN%3E%26nbsp%3B%3CSPAN%20data-contrast%3D%22none%22%3EUsing%20the%20hunting%20API%20security%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bteams%20can%20leverage%20their%20unique%20organizational%20knowledge%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%20expertise%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bto%20hunt%20for%20signs%20of%20compromise%20by%20creating%20their%20own%20custom%20queries%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E.%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559685%26quot%3B%3A570%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%221%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%222%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EFor%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Emore%20about%20hunting%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Esee%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fadvanced-hunting-overview%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3Ethis%20introduction%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eand%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eview%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ethe%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fadvanced-hunting-schema-tables%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3Evarious%20available%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Edata%20sources%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%221%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%222%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3ET%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eo%20learn%20more%20about%20the%20schema%20see%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fapi-advanced-hunting%3Fview%3Do365-worldwide%26amp%3Bbranch%3Dmtp-apis%22%20target%3D%22_self%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EAdvanced%20hunting%20API%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%20aria-level%3D%223%22%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EReady%20to%20start%3F%20Let's%20talk%20a%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3Euthentication%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3Eauthorization%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559738%26quot%3B%3A40%2C%26quot%3B335559739%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EAccessing%20Microsoft%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EThreat%20Protection%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EAPIs%20is%20granted%20in%20accordance%20with%20the%20service%20users%20and%20permissions%20model.%20For%20users%2C%20Single%20Sign%20On%20(SSO)%20and%20RBAC%20rules%20apply%2C%20and%20for%20services%20-%20permissions%20management.%20Using%20an%20AAD%20Applications%20model%20solves%20them%20all.%20A%20user%E2%80%99s%20API%20calls%20use%20the%20delegated%20permissions%20model.%20It%20means%20that%20the%20user%20context%20is%20used%20when%20calling%20the%20API%2C%20leveraging%20SSO%20capabilities.%20Since%20the%20user%20identity%20is%20used%2C%20the%20same%20RBAC%20rules%20applied%20for%20interactive%20user%2C%20applied%20also%20for%20API%20user.%20For%20services%2C%20the%20AAD%20application%20model%20is%20applied%20where%20the%20AAD%20Global%20Admin%20grants%20the%20permissions%20to%20the%20application.%20Any%20change%20of%20the%20application%20%E2%80%9Cmanifested%E2%80%9D%20permissions%20will%20require%20Global%20Admin%20Consent.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EFull%20control.%20Full%20transparency.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22TextRun%20SCXW26922864%20BCX0%22%20data-contrast%3D%22auto%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW26922864%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3ETo%20try%20it%20out%20please%20use%2C%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CA%20class%3D%22Hyperlink%20SCXW26922864%20BCX0%22%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fapi-hello-world%3Fview%3Do365-worldwide%26amp%3Bbranch%3Dmtp-apis%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20class%3D%22TextRun%20Underlined%20SCXW26922864%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW26922864%20BCX0%22%20data-ccp-charstyle%3D%22Hyperlink%22%3EMicrosoft%20Threat%20Protection%20API%20%E2%80%9CHello%E2%80%AFWorld%E2%80%9D%E2%80%AF%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20class%3D%22TextRun%20SCXW26922864%20BCX0%22%20data-contrast%3D%22auto%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW26922864%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3Esample.%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22EOP%20SCXW26922864%20BCX0%22%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22aad.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F218399i5F9599EA9A300736%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22aad.png%22%20alt%3D%22aad.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3ESay%20hello%20to%20the%20upcoming%20Microsoft%20Threat%20protection%20SIEM%20connectors!%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EWe%E2%80%99re%20thrilled%20to%20announce%20our%20latest%20integration%20with%20Splunk%20Enterprise%20and%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicro%20Focus%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EArcSight%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eare%20ready%20for%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Epreview%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%20data-leveltext%3D%22-%22%20data-font%3D%22Calibri%22%20data-listid%3D%2212%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%220%22%20data-aria-level%3D%221%22%3E%3CA%20href%3D%22https%3A%2F%2Fwww.splunk.com%2Fen_us%2Fsoftware%2Fsplunk-enterprise.html%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3ESplunk%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EEnterprise%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bpartnered%20with%20Microsoft%20Threat%20protection%20to%20develop%20a%20new%20add-on%20that%20allows%20our%20joint%20customers%20to%20easily%20integrate%20security%20incident%20in%20Splunk%20Enterprise.%20Security%20incidents%20and%20related%20evidence%20ingested%20through%20this%20add-on%20are%20mapped%20to%20the%20Splunk%20Common%20Information%20Model%2C%20which%20allows%20you%20to%20easily%20integrate%20the%20incidents%20into%20your%20existing%20processes%20and%20dashboards.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EWould%20you%20like%20to%20sign%20up%20for%E2%80%AFthe%20Preview%3F%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fforms.office.com%2FPages%2FResponsePage.aspx%3Fid%3Dv4j5cvGGr0GRqy180BHbR_37THxR53BClujmtpJxk_VUOTY5NURNWE0yQjA4M0YySlJMQ1FLM1JaNi4u%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EP%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Elease%20submit%20this%20form%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-contrast%3D%22none%22%3E.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22splunk.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F218394i8FE7B05CD0D0F6A8%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22splunk.png%22%20alt%3D%22splunk.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%20data-leveltext%3D%22-%22%20data-font%3D%22Calibri%22%20data-listid%3D%2212%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%220%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%3CSTRONG%3E%3CA%20class%3D%22Hyperlink%20SCXW224629983%20BCX0%22%20href%3D%22https%3A%2F%2Fwww.microfocus.com%2Fen-us%2Fproducts%2Fsiem-security-information-event-management%2Foverview%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20class%3D%22TextRun%20Underlined%20SCXW224629983%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW224629983%20BCX0%22%20data-ccp-charstyle%3D%22Hyperlink%22%3EMicro%20Focus%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22TextRun%20Underlined%20SCXW224629983%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW224629983%20BCX0%22%20data-ccp-charstyle%3D%22Hyperlink%22%3EArcSight%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FA%3E%3C%2FSTRONG%3E%3CSPAN%20class%3D%22TextRun%20SCXW224629983%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW224629983%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%26nbsp%3Bpartnered%20with%20Microsoft%20Threat%20protection%20to%20develop%20a%20new%20ArcSight%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22TextRun%20SCXW224629983%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SpellingErrorV2%20SCXW224629983%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3EFlexConnector%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22TextRun%20SCXW224629983%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW224629983%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%26nbsp%3Bthat%20allows%20our%20joint%20customers%20to%20integrate%20security%20incident%20in%20to%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22TextRun%20SCXW224629983%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SpellingErrorV2%20SCXW224629983%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3EArcsight%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22TextRun%20SCXW224629983%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW224629983%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E.%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22LineBreakBlob%20BlobObject%20DragDrop%20SCXW224629983%20BCX0%22%3E%3CSPAN%20class%3D%22SCXW224629983%20BCX0%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CBR%20class%3D%22SCXW224629983%20BCX0%22%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22TextRun%20SCXW224629983%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW224629983%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3EWould%20you%20like%20to%20sign%20up%20for%E2%80%AFthe%20Preview%3F%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22TextRun%20Highlight%20SCXW224629983%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW224629983%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CA%20class%3D%22Hyperlink%20SCXW224629983%20BCX0%22%20href%3D%22https%3A%2F%2Fforms.office.com%2FPages%2FResponsePage.aspx%3Fid%3Dv4j5cvGGr0GRqy180BHbR_37THxR53BClujmtpJxk_VUMlRRTUtRNkpTWUVYQkNYVjFLUEFOMDY2VS4u%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20class%3D%22TextRun%20Underlined%20SCXW224629983%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW224629983%20BCX0%22%20data-ccp-charstyle%3D%22Hyperlink%22%3EP%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22TextRun%20Underlined%20SCXW224629983%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW224629983%20BCX0%22%20data-ccp-charstyle%3D%22Hyperlink%22%3Elease%20submit%20this%20form%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20class%3D%22TextRun%20SCXW224629983%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW224629983%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E.%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22EOP%20SCXW224629983%20BCX0%22%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%3CSPAN%20class%3D%22EOP%20SCXW224629983%20BCX0%22%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-center%22%20image-alt%3D%22Arcsight.jpg%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F218395i7E0BA05CED17E117%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22Arcsight.jpg%22%20alt%3D%22Arcsight.jpg%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%3CSPAN%20class%3D%22EOP%20SCXW224629983%20BCX0%22%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%3CSPAN%20class%3D%22TextRun%20SCXW236535880%20BCX0%22%20style%3D%22font-family%3A%20inherit%3B%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW236535880%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3EAnd%20yes%2C%20a%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CA%20class%3D%22Hyperlink%20SCXW236535880%20BCX0%22%20style%3D%22font-family%3A%20inherit%3B%20background-color%3A%20%23ffffff%3B%22%20href%3D%22https%3A%2F%2Fazure.microsoft.com%2Fen-in%2Fservices%2Fazure-sentinel%2F%23%3A~%3Atext%3DAzure%2520Sentinel%2520is%2520your%2520birds%2Cwith%2520artificial%2520intelligence%2520(AI).%22%20target%3D%22_blank%22%20rel%3D%22noreferrer%20noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20class%3D%22TextRun%20Underlined%20SCXW236535880%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW236535880%20BCX0%22%20data-ccp-charstyle%3D%22Hyperlink%22%3EMicrosoft%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22TextRun%20Underlined%20SCXW236535880%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW236535880%20BCX0%22%20data-ccp-charstyle%3D%22Hyperlink%22%3EAzure%26nbsp%3B%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22TextRun%20Underlined%20SCXW236535880%20BCX0%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW236535880%20BCX0%22%20data-ccp-charstyle%3D%22Hyperlink%22%3ESentinel%3C%2FSPAN%3E%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20class%3D%22TextRun%20SCXW236535880%20BCX0%22%20style%3D%22font-family%3A%20inherit%3B%22%20data-contrast%3D%22none%22%3E%3CSPAN%20class%3D%22NormalTextRun%20SCXW236535880%20BCX0%22%20data-ccp-parastyle%3D%22Normal%20(Web)%22%3E%26nbsp%3Bconnector%20is%20also%20on%20the%20way%2C%20coming%20soon%20later%20this%20calendar%20year.%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSPAN%20class%3D%22EOP%20SCXW236535880%20BCX0%22%20style%3D%22font-family%3A%20inherit%3B%22%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FSPAN%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%20Threat%20Protection%20alerts%20via%20the%26nbsp%3B%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%20Graph%20Security%20API%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EThe%20Microsoft%20Graph%20Security%20API%20is%20an%20intermediary%20service%20(or%20broker)%20that%20provides%20a%20programmatic%20interface%20to%20connect%20multiple%20Microsoft%20security%20solution.%20Microsoft%20Threat%20Protection%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ealerts%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%20custom%20detection%20created%20by%20the%20customer%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bwill%20be%20surfaced%20under%20the%26nbsp%3B%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fgraph%2Fapi%2Fresources%2Falert%3Fview%3Dgraph-rest-1.0%2522%2520%5C%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%3EMicrosoft%20Graph%20Security%26nbsp%3BAlert%26nbsp%3BAPI%3C%2FSPAN%3E%3C%2FA%3E%26nbsp%3Bin%20the%20coming%20weeks%3CSPAN%20data-contrast%3D%22none%22%3E.%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EAnd%20there%E2%80%99s%20more%20c%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3Eoming%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bsoon%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EWe%20will%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ebe%20exposing%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bcalculated%20or%20%E2%80%98profiled%E2%80%99%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%20threat%20protection%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eentities%20(for%20example%2C%20device%2C%20user%2C%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eemail%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eand%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Efile%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E)%20and%20additional%20set%20of%20response%20actions.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EThe%20pattern%20of%20using%20other%20capabilities%20or%20entities%20will%20be%20similar.%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EIn%20addition%20we%20are%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eworking%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bto%20also%20expose%20an%20event%20streaming%20interface%20allowing%20customers%20to%20flow%20event%20data%20to%20an%20external%20storage%2C%20correlate%20with%20additional%20data%20sources%2C%20perform%20custom%20analytics%2C%20and%20others.%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20data-contrast%3D%22none%22%3EW%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ee%20will%20gradually%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eexpand%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ethe%20set%20of%20APIs%20and%20exp%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ea%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Ending%20our%20ecosystem%20to%20fulfill%20the%20needs%20of%20security%20operations%20teams%2C%20enabling%20interoperability%20with%20enterprise%20security%20applications%20and%20automation.%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3B%3CBR%20%2F%3E%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EAs%20always%2C%20your%20feedback%20is%20welcome!%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A259%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20data-contrast%3D%22none%22%3EAdditional%20reading%20and%20references%3C%2FSPAN%3E%3C%2FSTRONG%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559739%26quot%3B%3A160%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CTABLE%20data-tablestyle%3D%22MsoTableGrid%22%20data-tablelook%3D%221184%22%3E%0A%3CTBODY%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22561.667px%22%20height%3D%2229px%22%20data-celllook%3D%220%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fapi-hello-world%3Fview%3Do365-worldwide%26amp%3Bbranch%3Dmtp-apis%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EThreat%20Protection%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3BAPI%20%E2%80%9CHello%E2%80%AFWorld%E2%80%9D%3C%2FSPAN%3E%E2%80%AF%3C%2FA%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22561.667px%22%20height%3D%2229px%22%20data-celllook%3D%220%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fapi-access%3Fview%3Do365-worldwide%26amp%3Bbranch%3Dmtp-apis%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EThreat%20Protection%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3BAPI%20Documentation%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22561.667px%22%20height%3D%2229px%22%20data-celllook%3D%220%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fmedium.com%2Fwortell%2Fmicrosoft-threat-protection-jupyter-notebook-advancedhunting-sample-7217d85481c4%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EThreat%20Protection%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EJupyther%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bnotebooks%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B-%20MVP%20blog%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bby%20Maarten%20Goet%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3CTR%3E%0A%3CTD%20width%3D%22561.667px%22%20height%3D%2229px%22%20data-celllook%3D%220%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fsecurity%2Fmtp%2Fapi-articles%3Fview%3Do365-worldwide%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EOther%20API%20resources%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Bfor%20the%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Evarious%20protection%20products%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3C%2FTD%3E%0A%3C%2FTR%3E%0A%3C%2FTBODY%3E%0A%3C%2FTABLE%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1669234%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Icon.jpg%22%20style%3D%22width%3A%20780px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F218406i7B0E9D2D741B99FF%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Icon.jpg%22%20alt%3D%22Icon.jpg%22%20%2F%3E%3C%2FSPAN%3ELearn%20more%20about%3A%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%2214%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%221%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%20Threat%20Protection%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EIncident%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EHunting%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EAPIs%3C%2FSPAN%3E%3CSPAN%20data-ccp-props%3D%22%7B%26quot%3B134233117%26quot%3B%3Atrue%2C%26quot%3B134233118%26quot%3B%3Atrue%2C%26quot%3B201341983%26quot%3B%3A0%2C%26quot%3B335559740%26quot%3B%3A240%7D%22%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FLI%3E%0A%3CLI%20data-leveltext%3D%22%EF%82%B7%22%20data-font%3D%22Symbol%22%20data-listid%3D%2214%22%20aria-setsize%3D%22-1%22%20data-aria-posinset%3D%222%22%20data-aria-level%3D%221%22%3E%3CSPAN%20data-contrast%3D%22none%22%3EN%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Eew%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicrosoft%20Threat%20Protection%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3ESIEM%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Econnectors%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3Efor%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3ESplunk%20Enterprise%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3Band%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EMicro%20Focus%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3E%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%20data-contrast%3D%22none%22%3EArcSight%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%3C%2FLINGO-TEASER%3E
Microsoft

A typical enterprise environment often requires customers to augment security solutions by building their own custom automation logic to automate procedures, integrate data, and orchestrate actions to enable security teams to effectively operate and respond to threats. 

 
Today we are announcing public preview for three exciting enhancements: 

  • Microsoft Threat Protection Incident and Hunting APIs 
  • New Microsoft Threat Protection SIEM connectors for Splunk Enterprise and Micro Focus ArcSight
  • Microsoft Threat Protection alerts will be available soon via the Microsoft Graph Security API 

With these three additions, Microsoft Threat Protection is now an integration-ready platform! 
Let’s have a closer look at 
the new capabilities: 
 
Microsoft Threat Protection API model 

Microsoft Defender ATP offers a layered API model exposing data and capabilities in a structured, clear and easy to use model. Exposed through a standard Azure Active Directory (AAD) based authentication and authorization model and allowing access in context of users or SaaS applications. 

The lop-level Microsoft Threat Protection APIs will enable you to automate workflows based on the shared incident and advanced hunting tables: 


The I
ncidents API - This API exposes Microsoft Threat Protection incidents - a more efficient, more comprehensive and more descriptive evolution of alerts. Incidents help security professionals focus on what's critical by ensuring that the full attack scope and impacted assets are grouped together and surfaced in a timely manner under the incident API 

You can pull all the alerts related to the incident and other information about them such as severity, entities that were involved in the alert, the source of the alerts (Azure ATP, Microsoft Defender ATP , Office 365 ATP) and the reason they were linked together. To learn more about the schema see Incidents API and Update Incident API.

Cross-product threat hunting
APIThis API provides query-based access to Microsoft Threat Protection raw data store, aggregated across the suite protection products. Using the hunting API security teams can leverage their unique organizational knowledge and expertise to hunt for signs of compromise by creating their own custom queries.  

Ready to start? Let's talk authentication and authorization 

Accessing Microsoft Threat Protection APIs is granted in accordance with the service users and permissions model. For users, Single Sign On (SSO) and RBAC rules apply, and for services - permissions management. Using an AAD Applications model solves them all. A user’s API calls use the delegated permissions model. It means that the user context is used when calling the API, leveraging SSO capabilities. Since the user identity is used, the same RBAC rules applied for interactive user, applied also for API user. For services, the AAD application model is applied where the AAD Global Admin grants the permissions to the application. Any change of the application “manifested” permissions will require Global Admin Consent.  
Full control. Full transparency.

To try it out please use, Microsoft Threat Protection API “Hello World” sample. 

aad.png

 

Say hello to the upcoming Microsoft Threat protection SIEM connectors! 
We’re thrilled to announce our latest integration with Splunk Enterprise and Micro Focus ArcSight are ready for preview 

  • Splunk Enterprise partnered with Microsoft Threat protection to develop a new add-on that allows our joint customers to easily integrate security incident in Splunk Enterprise. Security incidents and related evidence ingested through this add-on are mapped to the Splunk Common Information Model, which allows you to easily integrate the incidents into your existing processes and dashboards.  
    Would you like to sign up for the Preview? Please submit this form. 
    splunk.png
  • Micro Focus ArcSight partnered with Microsoft Threat protection to develop a new ArcSight FlexConnector that allows our joint customers to integrate security incident in to Arcsight 
    Would you like to sign up for the Preview? Please submit this form. 

    Arcsight.jpg

And yes, a Microsoft Azure Sentinel connector is also on the way, coming soon later this calendar year. 

Microsoft Threat Protection alerts via the Microsoft Graph Security API 
The Microsoft Graph Security API is an intermediary service (or broker) that provides a programmatic interface to connect multiple Microsoft security solution. Microsoft Threat Protection alerts and custom detection created by the customer will be surfaced under the Microsoft Graph Security Alert API in the coming weeks. 

 

And there’s more coming soon 
We will be exposing calculated or ‘profiled’ Microsoft threat protection entities (for example, device, user, email and file) and additional set of response actions. The pattern of using other capabilities or entities will be similar. 
In addition we are working to also expose an event streaming interface allowing customers to flow event data to an external storage, correlate with additional data sources, perform custom analytics, and others. 
 

We will gradually expand the set of APIs and expanding our ecosystem to fulfill the needs of security operations teams, enabling interoperability with enterprise security applications and automation. 
As always, your feedback is welcome! 

 

Additional reading and references 

Microsoft Threat Protection API “Hello World”  

Microsoft Threat Protection API Documentation 

Microsoft Threat Protection Jupyther notebooks - MVP blog by Maarten Goet 

Other API resources for the various protection products 

 

8 Comments
Occasional Contributor

The Splunk form give "no permission"

Occasional Contributor

Very good your article.

 

I liked what I read.

 

I have some doubts and would like to receive opinions that can contribute.

 

These are more questions related to Sentinel and MTP.

 

I have the solutions in my environment and I'm in doubt about how to centralize everything.

 

I have Azure Sentinel receiving the Defender Atp, MCASB, Azure ATp, Office 365 ATp logs, among others.

 

I also have MCAS integrated with Azure ATP.

 

The question is. Where should all technologies be centralized?

 

That is, if I use Microsoft 365 Security Center to centralize Defender ATP, Azure ATP, MCAS and Office ATP, does it still make sense to receive these logs in Sentinel?

 

Would it be possible to integrate alerts generated in Sentinel with Microsoft 365 Security Center?

 

If I receive the solution logs on Sentinel, what would be the meaning of Microsoft 365 Security Center? Can I work with both, centralizing the solutions in both?

 

I know that there may not be a final answer, but I would be happy to get your position.

 

Thank you.

Microsoft
@mrboxx , issue is fixed please try again.

 

Senior Member
Occasional Visitor

Both links are the same. Video link opens the page with

 

P.S.: Thanks for the article!

Occasional Visitor

Regarding "we are working to also expose an event streaming interface allowing customers to flow event data to an external storage," any ETA on this?

Microsoft
 
@luizao_lf "MTP sentinel connector is also on the way, coming soon later this calendar year"/
We are planning to take care of all of Microsoft Threat Protection products for you with a single Sentinel connector. 
Please look for our upcoming announcements.. I can't share more at the moment we are looking to surprise you :)
Microsoft
@heaga, we will share more soon, send me your details in case you would like to join the very early preview. We will start with email + endpoint raw data.